crosspaste desktop - Moses Yebei

The Problem Users need a single pasteboard that works across Windows, macOS, and Linux without installing a separate server or exposing data to third‑party clouds. Copying text, images, or files on one machine and pasting them on another currently requires proprietary sync services or manual transfer workflows.

What This Does CrossPaste provides a server‑less, end‑to‑end encrypted pasteboard that syncs over LAN. Key components and their responsibilities:

Core networking – app/src/commonMain/kotlin/com/crosspaste/net/PasteClient.kt and app/src/commonMain/kotlin/com/crosspaste/net/PasteServer.kt implement the client‑server protocol that moves pasteboard items between devices.
Pairing & routing – app/src/commonMain/kotlin/com/crosspaste/net/routing/PairingV3Routing.kt and app/src/commonMain/kotlin/com/crosspaste/net/routing/SyncRouting.kt handle v3 pairing, session management, and sync pushes/pulls.
Rich content handling – app/src/commonMain/kotlin/com/crosspaste/paste/PasteboardMonitor.kt watches the local clipboard; app/src/commonMain/kotlin/com/crosspaste/image/OCRModule.kt extracts text from images locally, avoiding any network transfer.
UI layers – The desktop UI is built with Compose Multiplatform (app/src/commonMain/kotlin/com/crosspaste/app/AppWindowManager.kt); the web sidepanel lives in web/src/sidepanel/App.tsx and web/src/sidepanel/index.html; the CLI entry point is cli/src/cliNativeMain/kotlin/com/crosspaste/cli/Main.kt.
Encryption – Asymmetric keys are generated and stored per device; the crypto logic resides in app/src/commonMain/kotlin/com/crosspaste/net/plugin/ClientEncryptPlugin.kt and ServerEncryptPluginFactory.kt.

How It Is Wired Execution starts at the CLI (cli/src/cliNativeMain/kotlin/com/crosspaste/cli/Main.kt) or the desktop Compose entry (app/src/commonMain/kotlin/com/crosspaste/app/AppWindowManager.kt). The CLI invokes Main.kt which bootstrap the Kotlin/Native runtime and launches the UI. User actions in the UI flow through AppWindowManager.kt → PasteboardMonitor.kt → PasteClient.kt, which contacts the paired peer via the routing layer (PairingV3Routing.kt). Sync updates travel through SyncRouting.kt and are persisted to the local SQLite database (Sqlite badge in README). The web sidepanel (web/src/shared/core/index.ts) communicates with the same backend over WebSocket (web/src/sidepanel/App.tsx), enabling browser‑to‑device clipboard sync. OCR runs entirely in-process (image/OCRModule.kt) and writes extracted text back into the pasteboard without leaving the device.

How To Use It

Clone the repository verbatim:

  git clone https://github.com/moses-y/crosspaste-desktop

Build & run (first run downloads JetBrains Runtime and Gradle deps):

  cd crosspaste-desktop
  ./gradlew app:run

No environment variables or secret keys are required for basic LAN sync; the app generates its own key pair on first launch.

Real‑World Use A user copies a markdown snippet on a MacBook; the snippet appears instantly on a Windows desktop’s sidepanel and can be pasted into any editor. To retrieve a historic clip, the CLI command crosspaste search --query "error message" (exposed by cli/src/cliNativeMain/kotlin/com/crosspaste/cli/Main.kt) queries the local SQLite store and prints matching entries. The Chrome extension (web/src/sidepanel/index.html) mirrors the system clipboard, so a URL copied from a browser on one machine is paste‑able on any other device running CrossPaste.

Code Health & Issues

271 test files exist across the project; CI runs on every push (.github/workflows/ci.yml).
27 documentation files are present; a full changelog and license (LICENSE – AGPL‑3.0) are available.
Dependabot is enabled (.github/dependabot.yml), keeping web/package.json and Gradle files up to date.
No structural red flags were detected; the repo includes a .gitignore, CLAUDE.md, and standard CI configs.

The Bottom Line CrossPaste delivers a functional, cross‑platform pasteboard with end‑to‑end encryption and no central server, making it suitable for privacy‑conscious teams that need seamless clipboard sharing across desktops and browsers. The codebase is well‑structured with clear entry points and a solid test suite, but the learning curve is moderate because the pairing and routing logic span multiple Kotlin modules. It is a solid choice for organizations that value data locality and are comfortable with a Kotlin/Compose‑based desktop client.

What the analyser found

Deployment readiness

6/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

1,449 files

Kotlin1185
TypeScript84
TSX27
Markdown20
YAML15
Shell10

React

Module dependencies

The 10 most depended-upon modules of 117, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_web_src_shared_ws_ws_types["ws-types"] n1__plugin_paste_process_plugin["paste-process-plugin"] n2_web_src_shared_ws_ws_auth["ws-auth"] n3_web_src_shared_api_client["client"] n4_eb_src_shared_api_sync_error["sync-error"] n5_b_src_shared_sync_sync_state["sync-state"] n6_web_src_shared_ws_ws_client["ws-client"] n7_shared_ws_ws_message_handler["ws-message-handler"] n8_gin_remove_html_image_plugin["remove-html-image-plugin"] n9__i18n_translations_generated["translations.generated"] n3_web_src_shared_api_client --> n4_eb_src_shared_api_sync_error n8_gin_remove_html_image_plugin --> n1__plugin_paste_process_plugin n2_web_src_shared_ws_ws_auth --> n0_web_src_shared_ws_ws_types n6_web_src_shared_ws_ws_client --> n0_web_src_shared_ws_ws_types n6_web_src_shared_ws_ws_client --> n2_web_src_shared_ws_ws_auth n7_shared_ws_ws_message_handler --> n0_web_src_shared_ws_ws_types

Dependencies

6 of 19 declared dependencies are a major version behind. Resolved 18 of 19 against the registry.

Package	Declared	Latest	Behind
`@vitejs/plugin-react`	^4.3.4	6.0.5	2 major
`typescript`	^5.7.3	7.0.2	2 major
`vite`	^6.0.7	8.2.1	2 major
`@js-joda/core`	^5.7.0	6.1.0	1 major
`@noble/curves`	1.9.7	2.3.0	1 major
`lucide-react`	^0.577.0	1.31.0	1 major

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high1

medium4

low1

Pin third-party GitHub Actions to a commit SHAhigh4 occurrences

.github/workflows

hydraulic-software/conveyor/actions/build@v22.1, manyuanrong/setup-ossutil@v3.0, dorny/paths-filter@v4, gradle/actions/setup-gradle@v5

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Declare least-privilege permissions for GITHUB_TOKENmedium2 occurrences

.github/workflows/build-release.yml

2 workflow(s) declare no permissions, 1 of them reference secrets

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Install from the lockfile in CImedium

.github/workflows

npm install with a committed package-lock.json

A fresh resolution in CI means the tested dependency set is not the locked one, so the failure only appears after merge.

Fix: Use npm ci, yarn install --immutable, or pnpm install --frozen-lockfile.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Set persist-credentials: false on checkoutmedium

.github/workflows/build-beta-linux.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Set timeout-minutes on the workflow jobslow3 occurrences

.github/workflows/build-beta-linux.yml

3 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.